Trojan-Spy.Win32.GreenScreen et ses copains Résolu

Question

Bonjour,

Bonjour,

J'ai chopé un maleware qui m'ouvre des pseudo alertes du pare-feu windows (en anglais) : d'après ces fenêtres, je serais infecté par un trojan (le nom change : trojan-downloader.win32.agent, Trojan-Spy.Win32.keylogger.aa, Trojan-Spy.Win32.GreenScreen, Trojan-clicker.win32.tiny.h...) et le lien à suivre m'emmène droit vers l'achat d'un antivirus...

Bref, j'ai constaté qu'on était plusieurs à avoir un problème comparable mais j'hésite à suivre les instructions d'aide jusqu'au bout, je me dis que sans doute, chaque cas est différent... J'ai quand même remplacé Avast par Antivir, scanné ma bécane avec Malwarebytes, sans résultats, les pop-up sont toujours là... J'ose pas me servir de Combofix parce que j'ai pas de CD de réinstallation...

Je suis sous Vista et firefox.

Voilà, je vous post aussi au rapport hijackthis si ça peut aider...

Merci de votre aide...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:15:31, on 07/09/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\Adobe\Reader 8.0\Readereader_sl.exe
C:\Program Files\Google\Google EULA\GoogleEULALauncher.exe
C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe
C:\Program Files\Camera Assistant Software for Toshiba	raybar.exe
C:\Program Files\Toshiba\HDMICtrlMan\HDMICtrlMan.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
C:\Program Files\OrangeHSS\Systray\SystrayApp.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\ProgramData\infocom\ojypixyn.exe
C:\ProgramData\ydorwlqz\qfmvejyz.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Program Files\Toshiba\HDMICtrlMan\HCMSoundChanger.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Toshiba\TOSHIBA Recovery Disc Creator\ToRDC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\marc\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [cfFncEnabler.exe] cfFncEnabler.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information	opi.exe -startup
O4 - HKLM\..\Run: [Google EULA Launcher] c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe IE PA
O4 - HKLM\..\Run: [Toshiba TEMPO] C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba	raybar.exe" /start
O4 - HKLM\..\Run: [HDMICtrlMan] C:\Program Files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\OrangeHSS\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\VistaCodecPack\QT\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKCU\..\Run: [infocom] C:\ProgramData\infocom\ojypixyn.exe
O4 - HKCU\..\Run: [9ig0Esf1wo] C:\ProgramData\ydorwlqz\qfmvejyz.exe
O4 - HKCU\..\Run: [SmartSrvMnt] C:\ProgramData\SmartSrvMnt\epcnedqx.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - .DEFAULT User Startup: TRDCReminder.lnk = C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe (User 'Default user')
O4 - Startup: TRDCReminder.lnk = C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: eBay - Achetez, Vendez - {76577871-04EC-495E-A12B-91F7C3600AFA} - https://www.ebay.fr (file missing)
O9 - Extra button: Amazon.fr - {8A918C1D-E123-4E36-B562-5C1519E434CE} - https://www.amazon.fr/exec/obidos/subst/home/home.html/262-6263521-6325360?_encoding=UTF8&link_code=hom&tag=Toshibafrbholink-21 (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SmartFaceVWatchSrv - Toshiba - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe
O23 - Service: Notebook Performance Tuning Service  (TempoMonitoringService) - Toshiba Europe GmbH - C:\Program Files\Toshiba TEMPRO\TempoSVC.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - Unknown owner - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (file missing)
O23 - Service: TOSHIBA SMART Log Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

Destrio5 · Answer

Salut,

---> Désactive l'UAC le temps de la désinfection :
https://www.zebulon.fr/astuces/pratique/220-desactiver-l-uac-dans-vista.html

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

Destrio5 · Answer

Il a dit : "scanné ma bécane avec Malwarebytes, sans résultats"

pich · Answer

Salut Destrio5, merci du coup de main... Voici le rapport de Combofix : ComboFix 08-09-05.03 - marc 2008-09-07 17:11:36.1 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.2161 [GMT 2:00] Endroit: C:\Users\marc\Desktop\ComboFix.exe * Création d'un nouveau point de restauration . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Windows\system32\actskn43.ocx . ((((((((((((((((((((((((((((( Fichiers créés 2008-08-07 to 2008-09-07 )))))))))))))))))))))))))))))))))))) . 2008-09-07 17:09 . 2008-09-07 17:10 d-------- C:\327882R2FWJFW 2008-09-07 12:41 . 2008-09-07 12:41 d-------- C:\Users\All Users\Avira 2008-09-07 12:41 . 2008-09-07 12:41 d-------- C:\ProgramData\Avira 2008-09-07 12:41 . 2008-09-07 12:41 d-------- C:\Program Files\Avira 2008-09-06 18:46 . 2008-09-06 18:46 d-------- C:\_OTMoveIt 2008-09-06 18:25 . 2008-09-06 18:25 d-------- C:\Users\All Users\SmartSrvMnt 2008-09-06 18:25 . 2008-09-06 18:25 d-------- C:\ProgramData\SmartSrvMnt 2008-09-06 16:32 . 2008-09-06 16:32 d-------- C:\Users\marc\AppData\Roaming\Malwarebytes 2008-09-06 16:32 . 2008-09-06 16:32 d-------- C:\Users\All Users\Malwarebytes 2008-09-06 16:32 . 2008-09-06 16:32 d-------- C:\ProgramData\Malwarebytes 2008-09-05 21:13 . 2008-09-07 12:53 d-------- C:\Program Files\a-squared Anti-Malware 2008-09-05 20:45 . 2008-09-05 20:45 d-------- C:\Program Files\Enigma Software Group 2008-09-04 18:25 . 2008-09-04 18:25 d-------- C:\Users\marc\AppData\Roaming\vlc 2008-09-04 18:24 . 2008-09-04 18:24 d-------- C:\Program Files\VideoLAN 2008-09-04 18:07 . 2008-09-04 18:07 d-------- C:\Users\All Users\ydorwlqz 2008-09-04 18:07 . 2008-09-04 18:07 d-------- C:\Users\All Users\infocom 2008-09-04 18:07 . 2008-09-04 18:07 d-------- C:\ProgramData\ydorwlqz 2008-09-04 18:07 . 2008-09-04 18:07 d-------- C:\ProgramData\infocom 2008-09-01 22:53 . 2008-09-01 22:53 d-------- C:\Program Files\ASIO4ALL v2 2008-08-31 12:48 . 2008-08-31 12:48 d-------- C:\Program Files\VirtualDJ 2008-08-30 11:45 . 2008-08-30 11:45 d-------- C:\Program Files\MP3Gain 2008-08-27 19:19 . 2008-08-27 19:19 d-------- C:\Users\marc\AppData\Roaming\Apple Computer 2008-08-27 19:19 . 2008-08-27 19:19 d-------- C:\Program Files\iTunes 2008-08-27 19:19 . 2008-08-27 19:19 d-------- C:\Program Files\iPod 2008-08-27 19:19 . 2008-08-27 19:19 d-------- C:\Program Files\Bonjour 2008-08-27 19:18 . 2008-08-27 19:18 d-------- C:\Program Files\Apple Software Update 2008-08-27 19:17 . 2008-08-27 19:17 d-------- C:\Users\All Users\Apple 2008-08-27 19:17 . 2008-08-27 19:17 d-------- C:\ProgramData\Apple 2008-08-27 19:17 . 2008-08-27 19:17 d-------- C:\Program Files\Common Files\Apple 2008-08-27 17:08 . 2008-08-27 17:08 d-------- C:\Program Files\CDex_150 2008-08-27 14:15 . 2008-08-27 14:24 d-------- C:\Users\marc\AppData\Roaming\Blue Cat Audio 2008-08-27 14:15 . 2008-08-27 14:15 d-------- C:\Program Files\Blue Cat Audio 2008-08-27 13:09 . 2008-08-27 13:09 dr------- C:\Windows\System32\config\systemprofile\Music 2008-08-27 12:53 . 2008-09-03 23:16 d-------- C:\Audio 2008-08-27 08:42 . 2008-08-27 08:42 d-------- C:\Users\marc\AppData\Roaming\skypePM 2008-08-27 08:42 . 2008-08-27 08:42 56 --ah----- C:\Users\All Users\ezsidmv.dat 2008-08-27 08:42 . 2008-08-27 08:42 56 --ah----- C:\ProgramData\ezsidmv.dat 2008-08-27 08:41 . 2008-08-27 12:38 d-------- C:\Users\marc\AppData\Roaming\Skype 2008-08-26 22:58 . 2008-07-16 03:32 2,048 --a------ C:\Windows\System32 zres.dll 2008-08-26 22:47 . 2008-08-27 19:19 d-------- C:\Users\All Users\Apple Computer 2008-08-26 22:47 . 2008-08-27 19:19 d-------- C:\ProgramData\Apple Computer 2008-08-26 22:47 . 2008-08-26 22:47 d-------- C:\Program Files\VistaCodecPack 2008-08-26 20:56 . 2008-08-26 20:56 d-------- C:\Windows\PCHEALTH 2008-08-26 20:56 . 2008-08-26 20:56 d-------- C:\Program Files\Microsoft.NET 2008-08-26 20:54 . 2008-08-26 20:54 d-------- C:\Program Files\Microsoft Visual Studio 8 2008-08-26 20:53 . 2008-08-26 20:53 dr-h----- C:\MSOCache 2008-08-26 20:26 . 2008-08-26 20:26 d-------- C:\Program Files\IZArc 2008-08-26 19:13 . 2008-08-26 19:13 d-------- C:\Users\All Users\Skype 2008-08-26 19:13 . 2008-08-26 19:13 d-------- C:\ProgramData\Skype 2008-08-26 19:13 . 2008-08-26 19:13 d-------- C:\Program Files\Skype 2008-08-26 19:13 . 2008-08-26 19:13 d-------- C:\Program Files\Common Files\Skype 2008-08-26 15:30 . 2008-08-26 15:31 d-------- C: emp\HP_WebRelease 2008-08-26 15:30 . 2008-08-26 15:30 d-------- C: emp 2008-08-26 15:20 . 2008-08-26 15:20 d-------- C:\Program Files\SAGEM 2008-08-26 15:13 . 2008-08-26 15:13 d-------- C:\Program Files\Guitar Pro 5 2008-08-26 14:59 . 2008-08-26 14:59 d-------- C:\Users\marc\AppData\Roaming\StatSoft 2008-08-26 14:59 . 2008-08-26 14:59 d-------- C:\Users\All Users\StatSoft 2008-08-26 14:59 . 2008-08-26 14:59 d-------- C:\ProgramData\StatSoft 2008-08-26 14:59 . 2008-08-26 14:59 d-------- C:\Program Files\StatSoft 2008-08-26 14:59 . 2004-06-18 09:40 1,060,864 -ra------ C:\Windows\System32\cdintf210.dll 2008-08-26 14:59 . 1999-09-09 12:28 446,464 -ra------ C:\Windows\System32\HHActiveX.dll 2008-08-26 14:59 . 2001-03-05 12:11 98,304 --a------ C:\Windows\System32 sccvid.dll 2008-08-26 14:59 . 1998-06-17 20:07 57,344 --------- C:\Windows\System32\Mfc42loc.dll 2008-08-26 14:59 . 2008-08-27 19:42 1,514 --a------ C:\Users\marc\AppData\Roaming\WWB7_32.DAT 2008-08-26 14:41 . 2008-08-26 14:41 d-------- C:\Program Files\PowerISO 2008-08-26 14:29 . 2008-08-26 14:29 d-------- C:\Users\All Users\eMule 2008-08-26 14:29 . 2008-08-26 14:29 d-------- C:\ProgramData\eMule 2008-08-26 14:29 . 2008-08-26 14:29 d-------- C:\Program Files\eMule 2008-08-26 13:55 . 2008-08-26 13:55 d-------- C:\Program Files\Alwil Software 2008-08-26 13:54 . 2008-08-26 13:54 327 --a------ C:\Windows\AudStu.INI 2008-08-26 13:49 . 2003-11-13 12:52 176,128 --a------ C:\Windows\System32\mgxoschk.dll 2008-08-26 13:49 . 2003-12-03 16:19 1,045 --a------ C:\Windows\mgxoschk.ini 2008-08-26 13:49 . 2008-08-26 13:49 24 --a------ C:\Windows\magix.ini 2008-08-26 13:27 . 2008-06-26 03:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll 2008-08-26 13:27 . 2008-06-26 03:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll 2008-08-26 13:26 . 2008-06-26 05:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll 2008-08-26 13:20 . 2006-12-12 18:51 61,440 --a------ C:\Windows\System32\Autodial2000.dll 2008-08-26 13:19 . 2008-08-26 13:27 d-------- C:\Program Files\OrangeHSS 2008-08-26 13:19 . 2008-08-26 13:19 d-------- C:\Program Files\Common Files\France Telecom 2008-08-26 13:19 . 2003-03-19 06:20 1,060,864 --a------ C:\Windows\System32\MFC71.dll 2008-08-26 13:19 . 2003-09-16 09:07 499,712 --a------ C:\Windows\System32\msvcp71.dll 2008-08-26 13:19 . 2003-02-21 13:42 348,160 --a------ C:\Windows\System32\MSVCR71.dll 2008-08-26 13:19 . 2003-03-19 04:05 89,088 --a------ C:\Windows\System32\atl71.dll 2008-08-26 13:18 . 2008-07-19 07:09 1,811,656 --a------ C:\Windows\System32\wuaueng.dll 2008-08-26 13:18 . 2008-07-19 05:44 1,524,736 --a------ C:\Windows\System32\wucltux.dll 2008-08-26 13:18 . 2008-07-19 07:10 53,448 --a------ C:\Windows\System32\wuauclt.exe 2008-08-26 13:18 . 2008-07-19 07:10 45,768 --a------ C:\Windows\System32\wups2.dll 2008-08-26 13:17 . 2008-07-19 07:09 563,912 --a------ C:\Windows\System32\wuapi.dll 2008-08-26 13:17 . 2008-07-18 22:08 163,904 --a------ C:\Windows\System32\wuwebv.dll 2008-08-26 13:17 . 2008-07-19 05:44 83,456 --a------ C:\Windows\System32\wudriver.dll 2008-08-26 13:17 . 2008-07-19 07:10 36,552 --a------ C:\Windows\System32\wups.dll 2008-08-26 13:17 . 2008-07-18 20:44 31,232 --a------ C:\Windows\System32\wuapp.exe 2008-08-25 20:53 . 2008-08-25 20:53 d-------- C:\Securitoo 2008-08-25 20:52 . 2008-08-25 20:52 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2008-08-25 20:46 . 2008-08-25 20:46 d-------- C:\Users\All Users\IsolatedStorage 2008-08-25 20:46 . 2008-08-25 20:46 d-------- C:\ProgramData\IsolatedStorage 2008-08-25 20:38 . 2008-08-25 20:38 d-------- C:\Users\marc\AppData\Roaming\myphotobook 2008-08-25 19:39 . 2008-08-25 19:39 d-------- C:\Users\marc\AppData\Roaming\ATI 2008-08-25 19:39 . 2008-08-25 19:39 d-------- C:\Users\All Users\ATI 2008-08-25 19:39 . 2008-08-25 19:39 d-------- C:\ProgramData\ATI 2008-08-25 19:38 . 2008-08-25 19:38 dr------- C:\Users\marc\Searches 2008-08-25 19:38 . 2008-08-25 19:38 dr------- C:\Users\marc\Contacts 2008-08-25 19:38 . 2008-08-25 19:38 d--hs---- C:\$RECYCLE.BIN 2008-08-25 19:37 . 2008-08-25 19:37 d-------- C:\Windows\Options 2008-08-25 19:37 . 2008-08-25 19:37 d-------- C:\Program Files\ltmoh 2008-08-25 19:37 . 2006-12-26 16:40 491,520 --a------ C:\Windows\System32\cselect.exe 2008-08-25 19:37 . 2003-02-25 15:42 128,113 --a------ C:\Windows\System32\csellang.ini 2008-08-25 19:37 . 2003-12-05 09:48 77,824 --a------ C:\Windows\System32 osmreg.exe 2008-08-25 19:37 . 2003-11-01 03:59 45,056 --a------ C:\Windows\System32\csellang.dll 2008-08-25 19:37 . 2007-03-15 12:21 10,162 --a------ C:\Windows\System32 osmreg.ini 2008-08-25 19:37 . 2003-02-25 16:01 7,671 --a------ C:\Windows\System32\cseltbl.ini 2008-08-25 19:36 . 2006-11-29 13:06 3,426,072 --a------ C:\Windows\System32\d3dx9_32.dll 2008-08-25 19:36 . 2008-06-05 18:13 279,376 --a------ C:\Windows\System32\drivers os_sps32.sys 2008-08-25 19:32 . 2008-08-27 13:16 dr------- C:\Users\marc\Videos 2008-08-25 19:32 . 2008-08-25 19:38 dr------- C:\Users\marc\Saved Games 2008-08-25 19:32 . 2008-08-30 11:04 dr------- C:\Users\marc\Pictures 2008-08-25 19:32 . 2008-08-30 11:51 dr------- C:\Users\marc\Music 2008-08-25 19:32 . 2008-08-25 19:38 dr------- C:\Users\marc\Links 2008-08-25 19:32 . 2008-09-07 16:15 dr------- C:\Users\marc\Downloads 2008-08-25 19:32 . 2008-09-07 12:41 dr------- C:\Users\marc\Documents 2008-08-25 19:32 . 2006-11-02 14:37 d-------- C:\Users\marc\AppData\Roaming\Media Center Programs 2008-08-25 19:32 . 2008-08-25 19:32 d-------- C:\Users\marc\AppData\Roaming\InstallShield 2008-08-25 19:32 . 2008-08-25 19:32 d--h----- C:\Users\marc\AppData 2008-08-25 19:32 . 2008-09-05 16:36 d-------- C:\Users\marc 2008-08-25 19:32 . 2008-08-25 19:32 d-------- C:\Users\All Users\ToshibaEurope . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-26 18:57 --------- d-----w C:\ProgramData\Microsoft Help 2008-08-26 18:56 --------- d-----w C:\Program Files\MSBuild 2008-08-26 18:56 --------- d-----w C:\Program Files\Microsoft Works 2008-08-26 13:20 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-26 12:44 --------- d-----w C:\Program Files\Google 2008-08-26 12:07 --------- d-----w C:\ProgramData\McAfee 2008-08-26 11:50 4,608 ----a-w C:\Windows\System32\w95inf32.dll 2008-08-26 11:50 2,272 ----a-w C:\Windows\System32\w95inf16.dll 2008-08-25 17:36 --------- d-----w C:\ProgramData\Toshiba 2008-08-25 17:36 --------- d-----w C:\Program Files\Toshiba 2008-08-25 17:29 --------- d-sh--w C:\ProgramData\Modèles 2008-08-25 17:29 --------- d-sh--w C:\ProgramData\Menu Démarrer 2008-08-25 17:29 --------- d-sh--w C:\ProgramData\Favoris 2008-08-25 17:29 --------- d-sh--w C:\ProgramData\Bureau 2008-08-25 17:29 --------- d-sh--w C:\Program Files\Fichiers communs 2008-08-25 16:22 --------- d-----w C:\Program Files\Realtek 2008-08-25 16:20 --------- d-----w C:\Program Files\Intel 2008-07-07 07:40 56,108 ----a-w C:\Windows\system32\drivers\scdemu.sys 2008-07-01 13:43 319,456 ----a-w C:\Windows\DIFxAPI.dll 2008-07-01 13:43 315,392 ----a-w C:\Windows\HideWin.exe 2008-06-27 04:15 827,392 ----a-w C:\Windows\System32\wininet.dll 2008-06-19 03:31 361,984 ----a-w C:\Windows\System32\IPSECSVC.DLL 2008-06-12 16:59 147,456 ----a-w C:\Windows\System32\igfxCoIn_v1502.dll 2008-01-21 02:43 174 --sha-w C:\Program Files\desktop.ini . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-04-24 430080] "infocom"="C:\ProgramData\infocom\ojypixyn.exe" [2008-09-04 94208] "9ig0Esf1wo"="C:\ProgramData\ydorwlqz\qfmvejyz.exe" [2008-09-04 73728] "SmartSrvMnt"="C:\ProgramData\SmartSrvMnt\epcnedqx.exe" [2008-09-06 90112] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information opi.exe" [2007-07-10 581632] "Google EULA Launcher"="c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe" [2008-05-28 20480] "Toshiba TEMPO"="C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe" [2008-04-24 103824] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "Camera Assistant Software"="C:\Program Files\Camera Assistant Software for Toshiba raybar.exe" [2008-04-29 417792] "HDMICtrlMan"="C:\Program Files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe" [2008-04-26 716800] "TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 431456] "HSON"="C:\Program Files\TOSHIBA\TBS\HSON.exe" [2007-10-31 54608] "SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [2008-01-25 509816] "00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-03-19 716800] "Toshiba Registration"="C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe" [2008-01-11 574864] "SystrayORAHSS"="C:\Program Files\OrangeHSS\Systray\SystrayApp.exe" [2006-12-12 90112] "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-07-07 167936] "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040] "QuickTime Task"="C:\Program Files\VistaCodecPack\QT\QTTask.exe" [2008-05-27 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "RtHDVCpl"="RtHDVCpl.exe" [2008-04-08 C:\Windows\RtHDVCpl.exe] "NDSTray.exe"="NDSTray.exe" [BU] C:\Users\marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ TRDCReminder.lnk - C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe [2008-03-05 393216] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm "msacm.avis"= ff_acm.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{7513AF2C-3C2F-44CA-B4F8-1788C5F0BED5}C:\program files\emule\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule "UDP Query User{00EFF942-5858-42B6-962B-F7AA0CDED1A3}C:\program files\emule\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule "{517DC5B7-F252-45D7-969E-989A721D7388}"= C:\Program Files\Skype\Phone\Skype.exe:Skype "{989EF367-94CF-4522-8861-1CA1CAD1BB98}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{142907E0-19E9-4E3D-91C3-2F03910CDAE4}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{1319FC60-4536-4A09-94B2-9DE64B238F51}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{FB1D230B-A3F0-4BC2-9F1D-A00C44316FF0}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes "{6B4E3C68-B80D-4978-9FF9-9D8FE09E8EB1}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe"= C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS R2 ConfigFree Service;ConfigFree Service;C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [2008-04-17 40960] R2 TempoMonitoringService;Notebook Performance Tuning Service ;C:\Program Files\Toshiba TEMPRO\TempoSVC.exe [2008-04-24 99720] R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [2007-12-03 126976] R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2008-04-08 3548672] R3 FwLnk;FwLnk Driver;C:\Windows\system32\DRIVERS\FwLnk.sys [2006-11-20 7168] R3 NETw5v32;Pilote de carte Intel(R) Wireless WiFi Link pour Windows Vista 32 bits ;C:\Windows\system32\DRIVERS\NETw5v32.sys [2008-04-28 3658752] R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [2008-04-24 73728] S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224] S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 27072] S4 ErrDev;Microsoft Hardware Error Device Driver;C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656] S4 MegaSR;MegaSR;C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0cdb3124-72cd-11dd-b91b-0016eaa629a2}] \shell\AutoRun\command - H:\LaunchU3.exe -a *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 . - - - - ORPHANS REMOVED - - - - HKLM-Run-ITSecMng - C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe HKLM-Run-cfFncEnabler.exe - cfFncEnabler.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Users\marc\AppData\Roaming\Mozilla\Firefox\Profiles\4ed6cqid.default\ FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins pitunes.dll FF -: plugin - C:\Program Files\VistaCodecPack\QT\Plugins pqtplugin.dll FF -: plugin - C:\Program Files\VistaCodecPack\QT\Plugins pqtplugin2.dll FF -: plugin - C:\Program Files\VistaCodecPack\QT\Plugins pqtplugin3.dll FF -: plugin - C:\Program Files\VistaCodecPack\QT\Plugins pqtplugin4.dll FF -: plugin - C:\Program Files\VistaCodecPack\QT\Plugins pqtplugin5.dll FF -: plugin - C:\Program Files\VistaCodecPack\QT\Plugins pqtplugin6.dll FF -: plugin - C:\Program Files\VistaCodecPack m\browser\plugins ppl3260.dll FF -: plugin - C:\Program Files\VistaCodecPack m\browser\plugins prpjplug.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-07 17:15:02 Windows 6.0.6001 Service Pack 1 NTFS Balayage processus cachés ... Balayage caché autostart entries ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run TOSCDSPD = C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i?????a???D???P?2?x?2???2???2?? Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-09-07 17:16:42 ComboFix-quarantined-files.txt 2008-09-07 15:16:39 Pre-Run: 43,930,636,288 octets libres Post-Run: 43,815,993,344 octets libres 268 --- E O F --- 2008-09-06 09:42:47

Destrio5 · Answer

1/

---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :




KillAll::

Folder::
C:\ProgramData\SmartSrvMnt
C:\ProgramData\infocom
C:\ProgramData\ydorwlqz
C:\Users\All Users\infocom 
C:\Users\All Users\ydorwlqz 
C:\Users\All Users\SmartSrvMnt

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0cdb3124-72cd-11dd-b91b-0016eaa629a2}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"infocom"=-
"9ig0Esf1wo"=-
"SmartSrvMnt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"SunJavaUpdateSched"=-
"Adobe Reader Speed Launcher"=-
"RtHDVCpl"=-




---> Colle la sélection dans le bloc-notes

---> Enregistre ce fichier sur le bureau (Impératif)

---> Nom du fichier : CFScript
---> Type du fichier : tous les fichiers
---> Clique sur Enregistrer
---> Quitte le bloc-notes


2/

---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

[*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

[*] Une fois le scan achevé, un rapport va s'afficher : poste-le

[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt

pich · Answer

Voici le rapport : ComboFix 08-09-05.03 - marc 2008-09-07 21:25:12.2 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.2194 [GMT 2:00] Endroit: C:\Users\marc\Desktop\ComboFix.exe Command switches used :: C:\Users\marc\Desktop\CFScript.txt * Création d'un nouveau point de restauration . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\ProgramData\infocom C:\ProgramData\infocom\ojypixyn.exe C:\ProgramData\SmartSrvMnt C:\ProgramData\SmartSrvMnt\epcnedqx.exe C:\ProgramData\ydorwlqz C:\ProgramData\ydorwlqz\qfmvejyz.exe C:\Users\All Users\infocom C:\Users\All Users\infocom\ojypixyn.exe C:\Users\All Users\SmartSrvMnt C:\Users\All Users\SmartSrvMnt\epcnedqx.exe C:\Users\All Users\ydorwlqz C:\Users\All Users\ydorwlqz\qfmvejyz.exe . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-08-07 to 2008-09-07 )))))))))))))))))))))))))))))))))))) . 2008-09-07 17:22 . 2008-09-07 17:22 d-------- C:\Users\All Users\aplapp 2008-09-07 17:22 . 2008-09-07 17:22 d-------- C:\ProgramData\aplapp 2008-09-07 12:41 . 2008-09-07 12:41 d-------- C:\Users\All Users\Avira 2008-09-07 12:41 . 2008-09-07 12:41 d-------- C:\ProgramData\Avira 2008-09-07 12:41 . 2008-09-07 12:41 d-------- C:\Program Files\Avira 2008-09-06 18:46 . 2008-09-06 18:46 d-------- C:\_OTMoveIt 2008-09-06 16:32 . 2008-09-06 16:32 d-------- C:\Users\marc\AppData\Roaming\Malwarebytes 2008-09-06 16:32 . 2008-09-06 16:32 d-------- C:\Users\All Users\Malwarebytes 2008-09-06 16:32 . 2008-09-06 16:32 d-------- C:\ProgramData\Malwarebytes 2008-09-05 21:13 . 2008-09-07 12:53 d-------- C:\Program Files\a-squared Anti-Malware 2008-09-05 20:45 . 2008-09-05 20:45 d-------- C:\Program Files\Enigma Software Group 2008-09-04 18:25 . 2008-09-04 18:25 d-------- C:\Users\marc\AppData\Roaming\vlc 2008-09-04 18:24 . 2008-09-04 18:24 d-------- C:\Program Files\VideoLAN 2008-09-01 22:53 . 2008-09-01 22:53 d-------- C:\Program Files\ASIO4ALL v2 2008-08-31 12:48 . 2008-08-31 12:48 d-------- C:\Program Files\VirtualDJ 2008-08-30 11:45 . 2008-08-30 11:45 d-------- C:\Program Files\MP3Gain 2008-08-27 19:19 . 2008-08-27 19:19 d-------- C:\Users\marc\AppData\Roaming\Apple Computer 2008-08-27 19:19 . 2008-08-27 19:19 d-------- C:\Program Files\iTunes 2008-08-27 19:19 . 2008-08-27 19:19 d-------- C:\Program Files\iPod 2008-08-27 19:19 . 2008-08-27 19:19 d-------- C:\Program Files\Bonjour 2008-08-27 19:18 . 2008-08-27 19:18 d-------- C:\Program Files\Apple Software Update 2008-08-27 19:17 . 2008-08-27 19:17 d-------- C:\Users\All Users\Apple 2008-08-27 19:17 . 2008-08-27 19:17 d-------- C:\ProgramData\Apple 2008-08-27 19:17 . 2008-08-27 19:17 d-------- C:\Program Files\Common Files\Apple 2008-08-27 17:08 . 2008-08-27 17:08 d-------- C:\Program Files\CDex_150 2008-08-27 14:15 . 2008-08-27 14:24 d-------- C:\Users\marc\AppData\Roaming\Blue Cat Audio 2008-08-27 14:15 . 2008-08-27 14:15 d-------- C:\Program Files\Blue Cat Audio 2008-08-27 13:09 . 2008-08-27 13:09 dr------- C:\Windows\System32\config\systemprofile\Music 2008-08-27 12:53 . 2008-09-03 23:16 d-------- C:\Audio 2008-08-27 08:42 . 2008-08-27 08:42 d-------- C:\Users\marc\AppData\Roaming\skypePM 2008-08-27 08:42 . 2008-08-27 08:42 56 --ah----- C:\Users\All Users\ezsidmv.dat 2008-08-27 08:42 . 2008-08-27 08:42 56 --ah----- C:\ProgramData\ezsidmv.dat 2008-08-27 08:41 . 2008-08-27 12:38 d-------- C:\Users\marc\AppData\Roaming\Skype 2008-08-26 22:58 . 2008-07-16 03:32 2,048 --a------ C:\Windows\System32\tzres.dll 2008-08-26 22:47 . 2008-08-27 19:19 d-------- C:\Users\All Users\Apple Computer 2008-08-26 22:47 . 2008-08-27 19:19 d-------- C:\ProgramData\Apple Computer 2008-08-26 22:47 . 2008-08-26 22:47 d-------- C:\Program Files\VistaCodecPack 2008-08-26 20:56 . 2008-08-26 20:56 d-------- C:\Windows\PCHEALTH 2008-08-26 20:56 . 2008-08-26 20:56 d-------- C:\Program Files\Microsoft.NET 2008-08-26 20:54 . 2008-08-26 20:54 d-------- C:\Program Files\Microsoft Visual Studio 8 2008-08-26 20:53 . 2008-08-26 20:53 dr-h----- C:\MSOCache 2008-08-26 20:26 . 2008-08-26 20:26 d-------- C:\Program Files\IZArc 2008-08-26 19:13 . 2008-08-26 19:13 d-------- C:\Users\All Users\Skype 2008-08-26 19:13 . 2008-08-26 19:13 d-------- C:\ProgramData\Skype 2008-08-26 19:13 . 2008-08-26 19:13 d-------- C:\Program Files\Skype 2008-08-26 19:13 . 2008-08-26 19:13 d-------- C:\Program Files\Common Files\Skype 2008-08-26 15:30 . 2008-08-26 15:31 d-------- C:\temp\HP_WebRelease 2008-08-26 15:30 . 2008-08-26 15:30 d-------- C:\temp 2008-08-26 15:20 . 2008-08-26 15:20 d-------- C:\Program Files\SAGEM 2008-08-26 15:13 . 2008-08-26 15:13 d-------- C:\Program Files\Guitar Pro 5 2008-08-26 14:59 . 2008-08-26 14:59 d-------- C:\Users\marc\AppData\Roaming\StatSoft 2008-08-26 14:59 . 2008-08-26 14:59 d-------- C:\Users\All Users\StatSoft 2008-08-26 14:59 . 2008-08-26 14:59 d-------- C:\ProgramData\StatSoft 2008-08-26 14:59 . 2008-08-26 14:59 d-------- C:\Program Files\StatSoft 2008-08-26 14:59 . 2004-06-18 09:40 1,060,864 -ra------ C:\Windows\System32\cdintf210.dll 2008-08-26 14:59 . 1999-09-09 12:28 446,464 -ra------ C:\Windows\System32\HHActiveX.dll 2008-08-26 14:59 . 2001-03-05 12:11 98,304 --a------ C:\Windows\System32\tsccvid.dll 2008-08-26 14:59 . 1998-06-17 20:07 57,344 --------- C:\Windows\System32\Mfc42loc.dll 2008-08-26 14:59 . 2008-08-27 19:42 1,514 --a------ C:\Users\marc\AppData\Roaming\WWB7_32.DAT 2008-08-26 14:41 . 2008-08-26 14:41 d-------- C:\Program Files\PowerISO 2008-08-26 14:29 . 2008-08-26 14:29 d-------- C:\Users\All Users\eMule 2008-08-26 14:29 . 2008-08-26 14:29 d-------- C:\ProgramData\eMule 2008-08-26 14:29 . 2008-08-26 14:29 d-------- C:\Program Files\eMule 2008-08-26 13:55 . 2008-08-26 13:55 d-------- C:\Program Files\Alwil Software 2008-08-26 13:54 . 2008-08-26 13:54 327 --a------ C:\Windows\AudStu.INI 2008-08-26 13:49 . 2003-11-13 12:52 176,128 --a------ C:\Windows\System32\mgxoschk.dll 2008-08-26 13:49 . 2003-12-03 16:19 1,045 --a------ C:\Windows\mgxoschk.ini 2008-08-26 13:49 . 2008-08-26 13:49 24 --a------ C:\Windows\magix.ini 2008-08-26 13:27 . 2008-06-26 03:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll 2008-08-26 13:27 . 2008-06-26 03:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll 2008-08-26 13:26 . 2008-06-26 05:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll 2008-08-26 13:20 . 2006-12-12 18:51 61,440 --a------ C:\Windows\System32\Autodial2000.dll 2008-08-26 13:19 . 2008-08-26 13:27 d-------- C:\Program Files\OrangeHSS 2008-08-26 13:19 . 2008-08-26 13:19 d-------- C:\Program Files\Common Files\France Telecom 2008-08-26 13:19 . 2003-03-19 06:20 1,060,864 --a------ C:\Windows\System32\MFC71.dll 2008-08-26 13:19 . 2003-09-16 09:07 499,712 --a------ C:\Windows\System32\msvcp71.dll 2008-08-26 13:19 . 2003-02-21 13:42 348,160 --a------ C:\Windows\System32\MSVCR71.dll 2008-08-26 13:19 . 2003-03-19 04:05 89,088 --a------ C:\Windows\System32\atl71.dll 2008-08-26 13:18 . 2008-07-19 07:09 1,811,656 --a------ C:\Windows\System32\wuaueng.dll 2008-08-26 13:18 . 2008-07-19 05:44 1,524,736 --a------ C:\Windows\System32\wucltux.dll 2008-08-26 13:18 . 2008-07-19 07:10 53,448 --a------ C:\Windows\System32\wuauclt.exe 2008-08-26 13:18 . 2008-07-19 07:10 45,768 --a------ C:\Windows\System32\wups2.dll 2008-08-26 13:17 . 2008-07-19 07:09 563,912 --a------ C:\Windows\System32\wuapi.dll 2008-08-26 13:17 . 2008-07-18 22:08 163,904 --a------ C:\Windows\System32\wuwebv.dll 2008-08-26 13:17 . 2008-07-19 05:44 83,456 --a------ C:\Windows\System32\wudriver.dll 2008-08-26 13:17 . 2008-07-19 07:10 36,552 --a------ C:\Windows\System32\wups.dll 2008-08-26 13:17 . 2008-07-18 20:44 31,232 --a------ C:\Windows\System32\wuapp.exe 2008-08-25 20:53 . 2008-08-25 20:53 d-------- C:\Securitoo 2008-08-25 20:52 . 2008-08-25 20:52 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2008-08-25 20:46 . 2008-08-25 20:46 d-------- C:\Users\All Users\IsolatedStorage 2008-08-25 20:46 . 2008-08-25 20:46 d-------- C:\ProgramData\IsolatedStorage 2008-08-25 20:38 . 2008-08-25 20:38 d-------- C:\Users\marc\AppData\Roaming\myphotobook 2008-08-25 19:39 . 2008-08-25 19:39 d-------- C:\Users\marc\AppData\Roaming\ATI 2008-08-25 19:39 . 2008-08-25 19:39 d-------- C:\Users\All Users\ATI 2008-08-25 19:39 . 2008-08-25 19:39 d-------- C:\ProgramData\ATI 2008-08-25 19:38 . 2008-08-25 19:38 dr------- C:\Users\marc\Searches 2008-08-25 19:38 . 2008-08-25 19:38 dr------- C:\Users\marc\Contacts 2008-08-25 19:38 . 2008-08-25 19:38 d--hs---- C:\$RECYCLE.BIN 2008-08-25 19:37 . 2008-08-25 19:37 d-------- C:\Windows\Options 2008-08-25 19:37 . 2008-08-25 19:37 d-------- C:\Program Files\ltmoh 2008-08-25 19:37 . 2006-12-26 16:40 491,520 --a------ C:\Windows\System32\cselect.exe 2008-08-25 19:37 . 2003-02-25 15:42 128,113 --a------ C:\Windows\System32\csellang.ini 2008-08-25 19:37 . 2003-12-05 09:48 77,824 --a------ C:\Windows\System32\tosmreg.exe 2008-08-25 19:37 . 2003-11-01 03:59 45,056 --a------ C:\Windows\System32\csellang.dll 2008-08-25 19:37 . 2007-03-15 12:21 10,162 --a------ C:\Windows\System32\tosmreg.ini 2008-08-25 19:37 . 2003-02-25 16:01 7,671 --a------ C:\Windows\System32\cseltbl.ini 2008-08-25 19:36 . 2006-11-29 13:06 3,426,072 --a------ C:\Windows\System32\d3dx9_32.dll 2008-08-25 19:36 . 2008-06-05 18:13 279,376 --a------ C:\Windows\System32\drivers\tos_sps32.sys 2008-08-25 19:32 . 2008-08-27 13:16 dr------- C:\Users\marc\Videos 2008-08-25 19:32 . 2008-08-25 19:38 dr------- C:\Users\marc\Saved Games 2008-08-25 19:32 . 2008-08-30 11:04 dr------- C:\Users\marc\Pictures 2008-08-25 19:32 . 2008-08-30 11:51 dr------- C:\Users\marc\Music 2008-08-25 19:32 . 2008-08-25 19:38 dr------- C:\Users\marc\Links 2008-08-25 19:32 . 2008-09-07 16:15 dr------- C:\Users\marc\Downloads 2008-08-25 19:32 . 2008-09-07 12:41 dr------- C:\Users\marc\Documents 2008-08-25 19:32 . 2006-11-02 14:37 d-------- C:\Users\marc\AppData\Roaming\Media Center Programs 2008-08-25 19:32 . 2008-08-25 19:32 d-------- C:\Users\marc\AppData\Roaming\InstallShield 2008-08-25 19:32 . 2008-08-25 19:32 d--h----- C:\Users\marc\AppData 2008-08-25 19:32 . 2008-09-05 16:36 d-------- C:\Users\marc 2008-08-25 19:32 . 2008-08-25 19:32 d-------- C:\Users\All Users\ToshibaEurope 2008-08-25 19:32 . 2008-08-25 19:32 d-------- C:\ProgramData\ToshibaEurope 2008-08-25 19:29 . 2008-08-25 19:29 dr------- C:\Windows\System32\config\systemprofile\Contacts 2008-08-25 18:26 . 2008-08-25 18:26 0 -rahs---- C:\Windows\System32\drivers\TOSHIBA_Satellite A300_07047-FR_PSAGCE-02000.MRK 2008-08-25 18:23 . 2008-08-25 18:23 d-------- C:\Windows\System32\en 2008-08-25 18:23 . 2008-08-25 19:37 d-------- C:\Program Files\Common Files\Toshiba Shared . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-26 18:57 --------- d-----w C:\ProgramData\Microsoft Help 2008-08-26 18:56 --------- d-----w C:\Program Files\MSBuild 2008-08-26 18:56 --------- d-----w C:\Program Files\Microsoft Works 2008-08-26 13:20 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-26 12:44 --------- d-----w C:\Program Files\Google 2008-08-26 12:07 --------- d-----w C:\ProgramData\McAfee 2008-08-26 11:50 4,608 ----a-w C:\Windows\System32\w95inf32.dll 2008-08-26 11:50 2,272 ----a-w C:\Windows\System32\w95inf16.dll 2008-08-25 17:36 --------- d-----w C:\ProgramData\Toshiba 2008-08-25 17:36 --------- d-----w C:\Program Files\Toshiba 2008-08-25 17:29 --------- d-sh--w C:\ProgramData\Modèles 2008-08-25 17:29 --------- d-sh--w C:\ProgramData\Menu Démarrer 2008-08-25 17:29 --------- d-sh--w C:\ProgramData\Favoris 2008-08-25 17:29 --------- d-sh--w C:\ProgramData\Bureau 2008-08-25 17:29 --------- d-sh--w C:\Program Files\Fichiers communs 2008-08-25 16:22 --------- d-----w C:\Program Files\Realtek 2008-08-25 16:20 --------- d-----w C:\Program Files\Intel 2008-07-07 07:40 56,108 ----a-w C:\Windows\system32\drivers\scdemu.sys 2008-07-01 13:43 319,456 ----a-w C:\Windows\DIFxAPI.dll 2008-07-01 13:43 315,392 ----a-w C:\Windows\HideWin.exe 2008-06-27 04:15 827,392 ----a-w C:\Windows\System32\wininet.dll 2008-06-19 03:31 361,984 ----a-w C:\Windows\System32\IPSECSVC.DLL 2008-06-12 16:59 147,456 ----a-w C:\Windows\System32\igfxCoIn_v1502.dll 2008-01-21 02:43 174 --sha-w C:\Program Files\desktop.ini . ((((((((((((((((((((((((((((( snapshot@2008-09-07_17.15.34.92 ))))))))))))))))))))))))))))))))))))))))) . - 2008-09-07 14:08:22 1,082,224 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2008-09-07 19:29:57 1,082,224 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat - 2008-09-07 14:09:25 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2008-09-07 19:30:43 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2008-09-07 14:09:25 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2008-09-07 19:30:43 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2008-09-07 14:12:19 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT + 2008-09-07 19:32:32 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT + 2008-09-07 19:32:32 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 - 2008-09-07 14:11:42 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT + 2008-09-07 19:32:32 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT + 2008-09-07 19:32:32 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 - 2008-09-07 14:16:31 101,250 ----a-w C:\Windows\System32\perfc009.dat + 2008-09-07 15:52:33 101,250 ----a-w C:\Windows\System32\perfc009.dat - 2008-09-07 14:16:31 123,556 ----a-w C:\Windows\System32\perfc00C.dat + 2008-09-07 15:52:33 123,556 ----a-w C:\Windows\System32\perfc00C.dat - 2008-09-07 14:16:31 587,178 ----a-w C:\Windows\System32\perfh009.dat + 2008-09-07 15:52:33 587,178 ----a-w C:\Windows\System32\perfh009.dat - 2008-09-07 14:16:31 669,578 ----a-w C:\Windows\System32\perfh00C.dat + 2008-09-07 15:52:33 669,578 ----a-w C:\Windows\System32\perfh00C.dat - 2008-09-07 14:12:42 4,634 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2410694347-3961843581-1546052166-1000_UserData.bin + 2008-09-07 15:23:01 4,722 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2410694347-3961843581-1546052166-1000_UserData.bin - 2008-09-07 14:12:42 71,564 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2008-09-07 15:23:01 71,668 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2008-09-07 14:12:41 44,990 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2008-09-07 15:23:00 45,276 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-04-24 430080] "aplapp"="C:\ProgramData\aplapp\tcxcxmns.exe" [2008-09-07 98304] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416] "topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 581632] "Google EULA Launcher"="c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe" [2008-05-28 20480] "Toshiba TEMPO"="C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe" [2008-04-24 103824] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "Camera Assistant Software"="C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" [2008-04-29 417792] "HDMICtrlMan"="C:\Program Files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe" [2008-04-26 716800] "TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 431456] "HSON"="C:\Program Files\TOSHIBA\TBS\HSON.exe" [2007-10-31 54608] "SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [2008-01-25 509816] "00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-03-19 716800] "Toshiba Registration"="C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe" [2008-01-11 574864] "SystrayORAHSS"="C:\Program Files\OrangeHSS\Systray\SystrayApp.exe" [2006-12-12 90112] "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-07-07 167936] "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040] "QuickTime Task"="C:\Program Files\VistaCodecPack\QT\QTTask.exe" [2008-05-27 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "NDSTray.exe"="NDSTray.exe" [BU] C:\Users\marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ TRDCReminder.lnk - C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe [2008-03-05 393216] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm "msacm.avis"= ff_acm.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{7513AF2C-3C2F-44CA-B4F8-1788C5F0BED5}C:\program files\emule\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule "UDP Query User{00EFF942-5858-42B6-962B-F7AA0CDED1A3}C:\program files\emule\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule "{517DC5B7-F252-45D7-969E-989A721D7388}"= C:\Program Files\Skype\Phone\Skype.exe:Skype "{989EF367-94CF-4522-8861-1CA1CAD1BB98}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{142907E0-19E9-4E3D-91C3-2F03910CDAE4}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{1319FC60-4536-4A09-94B2-9DE64B238F51}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{FB1D230B-A3F0-4BC2-9F1D-A00C44316FF0}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes "{6B4E3C68-B80D-4978-9FF9-9D8FE09E8EB1}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe"= C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS R2 ConfigFree Service;ConfigFree Service;C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [2008-04-17 40960] R2 TempoMonitoringService;Notebook Performance Tuning Service ;C:\Program Files\Toshiba TEMPRO\TempoSVC.exe [2008-04-24 99720] R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [2007-12-03 126976] R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2008-04-08 3548672] R3 FwLnk;FwLnk Driver;C:\Windows\system32\DRIVERS\FwLnk.sys [2006-11-20 7168] R3 NETw5v32;Pilote de carte Intel(R) Wireless WiFi Link pour Windows Vista 32 bits ;C:\Windows\system32\DRIVERS\NETw5v32.sys [2008-04-28 3658752] R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [2008-04-24 73728] S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224] S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 27072] S4 ErrDev;Microsoft Hardware Error Device Driver;C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656] S4 MegaSR;MegaSR;C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-07 21:32:54 Windows 6.0.6001 Service Pack 1 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... C:\Users\marc\AppData\Local\Temp\Tar62C8.tmp 0 bytes C:\Users\marc\AppData\Local\Temp\Cab62C7.tmp 27455 bytes C:\Users\marc\AppData\Local\Temp\Cab6D62.tmp 0 bytes Scan termin‚ avec succŠs Les fichiers cach‚s: 3 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\Ati2evxx.exe C:\Windows\System32\audiodg.exe C:\Windows\System32\Ati2evxx.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Windows\System32\agrsmsvc.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\[u]0/u\FTRTSVC.exe C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe C:\Windows\System32\TODDSrv.exe C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Windows\System32\WUDFHost.exe C:\Windows\System32\conime.exe C:\Program Files\Toshiba\ConfigFree\NDSTray.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe C:\Program Files\Toshiba\HDMICtrlMan\HCMSoundChanger.exe C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\[u]0/u\AlertModule.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Windows\System32\wbem\WMIADAP.exe C:\Windows\System32\dllhost.exe . ************************************************************************** . Temps d'accomplissement: 2008-09-07 21:36:31 - machine was rebooted ComboFix-quarantined-files.txt 2008-09-07 19:36:25 ComboFix2.txt 2008-09-07 15:16:43 Pre-Run: 49,096,290,304 octets libres Post-Run: 48,865,419,264 octets libres 316 --- E O F --- 2008-09-06 09:42:47

Destrio5 · Answer

Fais un scan complet avec Antivir.

pich · Answer

Je lance ça, merci de ta réactivité...

pich · Answer

Voici le rapport mais les fenêtres sont toujours là... :( Avira AntiVir Personal Report file date: dimanche 7 septembre 2008 21:55 Scanning for 1599979 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows Vista Windows version: (Service Pack 1) [6.0.6001] Boot mode: Normally booted Username: SYSTEM Computer name: HAL9000 Version information: BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00 AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53 AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40 LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19 LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34 ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:54:15 ANTIVIR2.VDF : 7.0.6.94 2998784 Bytes 31/08/2008 10:42:18 ANTIVIR3.VDF : 7.0.6.124 202240 Bytes 05/09/2008 10:42:18 Engineversion : 8.1.1.28 AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21 AESCRIPT.DLL : 8.1.0.70 319866 Bytes 07/09/2008 10:42:22 AESCN.DLL : 8.1.0.23 119156 Bytes 10/07/2008 12:44:49 AERDL.DLL : 8.1.1.1 397683 Bytes 07/09/2008 10:42:22 AEPACK.DLL : 8.1.2.1 364917 Bytes 15/07/2008 12:58:35 AEOFFICE.DLL : 8.1.0.23 196987 Bytes 07/09/2008 10:42:21 AEHEUR.DLL : 8.1.0.51 1397111 Bytes 07/09/2008 10:42:21 AEHELP.DLL : 8.1.0.15 115063 Bytes 10/07/2008 12:44:48 AEGEN.DLL : 8.1.0.36 315764 Bytes 07/09/2008 10:42:20 AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 08:33:21 AECORE.DLL : 8.1.1.11 172406 Bytes 07/09/2008 10:42:19 AEBB.DLL : 8.1.0.1 53617 Bytes 10/07/2008 12:44:48 AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05 AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01 AVREP.DLL : 8.0.0.2 98344 Bytes 07/09/2008 10:42:19 AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40 AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23 AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49 SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02 SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40 NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10 RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07 RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, E:, Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: dimanche 7 septembre 2008 21:55 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'CCC.exe' - '1' Module(s) have been scanned Scan process 'iPodService.exe' - '1' Module(s) have been scanned Scan process 'SynTPHelper.exe' - '1' Module(s) have been scanned Scan process 'AlertModule.exe' - '1' Module(s) have been scanned Scan process 'CFSwMgr.exe' - '1' Module(s) have been scanned Scan process 'HCMSoundChanger.exe' - '1' Module(s) have been scanned Scan process 'CEC_MAIN.exe' - '1' Module(s) have been scanned Scan process 'MOM.exe' - '1' Module(s) have been scanned Scan process 'tcxcxmns.exe' - '1' Module(s) have been scanned Scan process 'TOSCDSPD.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned Scan process 'PWRISOVM.EXE' - '1' Module(s) have been scanned Scan process 'SystrayApp.exe' - '1' Module(s) have been scanned Scan process 'ToshibaRegistration.exe' - '1' Module(s) have been scanned Scan process 'TCrdMain.exe' - '1' Module(s) have been scanned Scan process 'SmoothView.exe' - '1' Module(s) have been scanned Scan process 'TPwrMain.exe' - '1' Module(s) have been scanned Scan process 'HDMICtrlMan.exe' - '1' Module(s) have been scanned Scan process 'traybar.exe' - '1' Module(s) have been scanned Scan process 'Toshiba.Tempo.UI.TrayApplication.exe' - '1' Module(s) have been scanned Scan process 'GoogleEULALauncher.exe' - '1' Module(s) have been scanned Scan process 'NDSTray.exe' - '1' Module(s) have been scanned Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned Scan process 'conime.exe' - '1' Module(s) have been scanned Scan process 'dwm.exe' - '1' Module(s) have been scanned Scan process 'taskeng.exe' - '1' Module(s) have been scanned Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned Scan process 'SmartFaceVWatchSrv.exe' - '1' Module(s) have been scanned Scan process 'taskeng.exe' - '1' Module(s) have been scanned Scan process 'WUDFHost.exe' - '1' Module(s) have been scanned Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'ULCDRSvr.exe' - '1' Module(s) have been scanned Scan process 'TosIPCSrv.exe' - '1' Module(s) have been scanned Scan process 'TosCoSrv.exe' - '1' Module(s) have been scanned Scan process 'TODDSrv.exe' - '1' Module(s) have been scanned Scan process 'TNaviSrv.exe' - '1' Module(s) have been scanned Scan process 'TempoSVC.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned Scan process 'CFSvcs.exe' - '1' Module(s) have been scanned Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'agrsmsvc.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'SLsvc.exe' - '1' Module(s) have been scanned Scan process 'audiodg.exe' - '0' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'PresentationFontCache.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsm.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'wininit.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 73 processes with 73 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Master boot sector HD1 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'E:\' [INFO] No virus was found! Starting to scan the registry. The registry was scanned ( '53' files ). Starting the file scan: Begin scan in 'C:\' C:\hiberfil.sys [WARNING] The file could not be opened! C:\pagefile.sys [WARNING] The file could not be opened! Begin scan in 'E:\' End of the scan: dimanche 7 septembre 2008 22:24 Used time: 28:34 Minute(s) The scan has been done completely. 17302 Scanning directories 352272 Files were scanned 0 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 352270 Files not concerned 3739 Archives were scanned 2 Warnings 0 Notes

Destrio5 · Answer

- Télécharge SmitfraudFix (de de S!Ri, balltrap34 et moe31) : 
http://siri.urz.free.fr/Fix/SmitfraudFix.exe ou http://www.geekstogo.com/forum/files/file/6-smitfraudfix/ 

- Enregistre-le sur le bureau

- Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée

- Un rapport sera généré, poste-le dans ta prochaine réponse.

[*] process.exe est détecté par certains antivirus comme étant un risktool. Il ne s'agit pas d'un virus mais d'un utilitaire destiné à mettre fin à des processus.[*]

** Ne fais l'étape 2 que si on te le demande, on doit d'abord examiner le premier rapport de SmitfraudFix

pich · Answer

Jusqu'à Jeudi, je pourrai pas trop m'occuper de ça sauf le soir après genre 21h... Désolé..
Je fais le truc que tu m'a demandé ce soir...

Destrio5 · Answer

Ok.

pich · Answer

Bonsoir Destrio5

J'ai lancé SmitfraudFix, le truc s'ouvre, je choisis le choix 1 (search) mais après, il se ferme et on dirait que rien ne se passe... la fenêtre se ferme pis plus rien (même quand j'attends longtemps)... dans le gestionnaire des programmes, y a aucune tâche en cours et dans les processus, y a bien un truc bizarre (alertmodule.exe) mais c'est tout...

Prochaine étape : après demain soir, désolé... :(

Destrio5 · Answer

Faudra essayer en mode sans échec.

pich · Answer

Bien vu, ça a marché... Voici le rapport ci dessous...
Heureusement que tu m'avais prévenu, SmitfraudFix, ça met Antivir dans tous ses états...

SmitFraudFix v2.346

Scan done at  1:16:54,98, 10/09/2008
Run from C:\Users\marc\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6001] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\Explorer.EXE
C:\Windows\helppane.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\marc


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\marc\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\marc\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
 
 

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, following keys are not inevitably infected!!!



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\Windows\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{48858613-D22F-4DC3-ABDB-F5F6721FE618}: DhcpNameServer=80.10.246.130 0.0.0.0
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F189AF1F-AB2D-4E09-9AB0-06C14CEE74C6}: DhcpNameServer=80.10.246.130 0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\..\{48858613-D22F-4DC3-ABDB-F5F6721FE618}: DhcpNameServer=80.10.246.130 0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F189AF1F-AB2D-4E09-9AB0-06C14CEE74C6}: DhcpNameServer=80.10.246.130 0.0.0.0
HKLM\SYSTEM\CS2\Services\Tcpip\..\{48858613-D22F-4DC3-ABDB-F5F6721FE618}: DhcpNameServer=80.10.246.130 0.0.0.0
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F189AF1F-AB2D-4E09-9AB0-06C14CEE74C6}: DhcpNameServer=80.10.246.130 0.0.0.0
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=80.10.246.130 0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=80.10.246.130 0.0.0.0
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=80.10.246.130 0.0.0.0


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

Destrio5 · Answer

Tu as toujours des fenêtres ?

pich · Answer

Oui...
J'ai pas pu me servir beaucoup de mon pc ce soir mais je viens d'en avoir une...
Au moment opportun, tu me diras comment désinstaller SmitfraudFix parce que ça cohabite très mal avec Antivir...
A partir de demain, je serai beaucoup plus dispo.

Bonne soirée

Destrio5 · Answer

Ok.

pich · Answer

Salut Destrio5

Bon, alors, en fait, je suis un bourricot, j'ai résilié mon abonnement internet pour changer de fournisseur internet et du coup ben, là, j'ai plus internet chez moi sur l'ordinateur "infecté"... C'était pas le bon moment...

Ceci dit, si depuis la dernière opération que tu m'a faite faire j'ai encore eu des fenêtres, elles ont été très peu nombreuses (par rapport à avant, seulement 3 ou 4) et plus du tout depuis que j'ai plus internet... Je me demande si ça peut être lié...

Voilà les nouvelles... Qu'est ce qu'on fait ?

Merci

Destrio5 · Answer

Tu vas avoir Internet quand ?

Supprime SmitFraudFix si tu veux.

pich · Answer

Ben ça dépend plus trop de moi mais de Free maintenant... Du coup je sais pas trop... A la fois, je confirme que j'ai plus eu de fenêtre du weekend...

SmitFraudFix, je supprime l'application posée sur le bureau, simplement ?

Destrio5 · Answer

"SmitFraudFix, je supprime l'application posée sur le bureau, simplement ?"
---> Oui.

"Ben ça dépend plus trop de moi mais de Free maintenant... Du coup je sais pas trop... A la fois, je confirme que j'ai plus eu de fenêtre du weekend... "
---> Ce n'est pas ton FAI qui t'affiche des pubs sur ton PC.

pich · Answer

Je change pas de FAI suite au trojan, c'était prévu depuis longtemps mais j'ai pas connecté les deux problèmes dans ma tête...
Est-ce que je fais un nouveau scan ou test pour vérifier que tout est ok ?

Destrio5 · Answer

Tu peux toujours faire un scan avec MBAM en le mettant à jour avant.

pich · Answer

Salut Destrio5...

Bon, désolé de répondre après autant de temps... 
J'ai eu des problèmes, j'ai du formater mon disque dur, bref du coup, le problème du trojan est résolu...

A la fois, je confirme que je n'avais plus de fenêtres après la dernière manip' que tu m'as fait faire...
Merci et désolé pour les conditions de travail un peu décousues...

Destrio5 · Answer

Ok, pas de problème.

Trojan-Spy.Win32.GreenScreen et ses copains - Page 2

Discussions similaires

Newsletters